4252cd1f98267be290e49050c54363066067d0b4871ddb67cad8f86b7799aef5

Analysis

max time kernel
144s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6e2a1d4bce6073fedf3f4376a94df401_JaffaCakes118.html
Size

140KB
MD5

6e2a1d4bce6073fedf3f4376a94df401
SHA1

2980a4c4d1ba9063ec5a3071134127441024e154
SHA256

4252cd1f98267be290e49050c54363066067d0b4871ddb67cad8f86b7799aef5
SHA512

c51b93abd002134facbfe7add092364bfda6fdfce32b25d818b84c0a8f55b063336e4a4f05c54464fcd906b634ae7a9731144ed89a739b9cfff6bb2475382ff5
SSDEEP

3072:0qUGGQ4pn575yfkMY+BES09JXAnyrZalI+YQ:05/5IsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000da1972a7ffa3be4193db33cc4fbbe35b000000000200000000001066000000010000200000004fc3a0e1087188667874e8341ef5aee12ccead588344bcc27eaf6eed058b41be000000000e80000000020000200000004d670f41acfce195b1d6717569832d43399526a8c61e3c721c2a3c93336e134720000000665197d0226ad260ae258dfda8650cc9ae5701098b0e871a2fdb44309c63d27440000000115a0878227c32838f0ad98edbbe762e53f020021623a03a98b919ca9fb08601dded1589a4a9df1effd8b68838e1a6ba2e8a6e99d3dad3b32d17fdf367436ac8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05bfa31c3adda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422707533"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D64CC61-19B6-11EF-BC57-569FD5A164C1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000da1972a7ffa3be4193db33cc4fbbe35b00000000020000000000106600000001000020000000226eb9f1d35649b7757ea82e86ab250148bf58f5e7ce0055ed135b9e95f0ca13000000000e800000000200002000000045b29444c7a2a1b12a3635b23cdf22f27967d8ebaaecb4aa2d987a07c49f13f39000000077d24d317c73cd09c862e9f1c0de7857344a9b6a51fbae5ffdd2898d203da7755e0a7e1e059a6663a20a2527abf7f694cf336201824813c889b34d633068c112668ff5c82da22ab5aa1f254babdfca8b0cb6d412e4a3937757e8aad3cdcb44d28c0d5270a7891e68418966a5f7928c998b31e625dd2a58b9476d982cc5f8c2ee42c6a23c9edb916c964906b6616dfc76400000000b673837ce60a9476f46f04f4ef2a9c94bd9d1a56e18cf4a2f46668dba8f325ad1d271ebde4da9e44a3d01fcf3dd830bc73d589b264fd23eac9c6433656bf092	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28
PID 2104 wrote to memory of 3052	2104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e2a1d4bce6073fedf3f4376a94df401_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
634ada7eb88c88375f05d7b62913ce06

SHA1
54520fafbd4d97785a936ca4081a9c4fe07e3b33

SHA256
2bb295a29a40d723a9b0cf3607acfdadf2885cebce080fddaf6ab9e642f9b5c4

SHA512
6c339cc31d3b25c73329158e22ca587e4375b6b7acb8ab0d69baefcd4379f7266ec03d3c3829286f9d4f5be9701d7bd678d5b50705a23bde47b70d8b87030ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c6852cafb7085dd566b6d703218350e

SHA1
dd37726f50cd51fa435553a23a39a45faa0cc0a9

SHA256
67280e66474a4ed1b79e35a20b69fc79318aab9e27942e8789ed734872fd149e

SHA512
ce119e472f56ee5ea61ecf46f3ef58b2c589c192c22c481d75fad2fdce8450213ad058a16af02ecf89b6019fd0cd50477daff05987af056488919643e72ffc27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62922319ca82a639def334d2a9a4ad7f

SHA1
c7be7b4d36dd5191fdf2c99db76ef3a07a06fabc

SHA256
ccbf8a729b4c11dcc1cfa4bccaedd923695bb90aac4cd26f39b823bbed567ec1

SHA512
2061b53a9ac99a3d28364ea604fa9692c4766d2bd09b0b437a79985d4e070e065aee514c37d5c16ee4cdbe51d9a48fa5c3fcb732a661bbecfb75dec2aac84522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1b4ba816f5552800b051955546f591c

SHA1
f30580e8733a64698a009745fab8371ca840f52a

SHA256
612115167689a67dce9e243f6812c9281097882c7aa504903bf824d41b5c1ee4

SHA512
48fc341bd66288de94243e285ee96af203071d134c528fa6329f617c9d0953209ec6d94b8bb227cc61bc901e0129fff63ec340392529f9831a3c77e51a0c087e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c49776f36e6b0c3c411ed4be89245c3

SHA1
e4d3755ada10dfbf77de822bd812311b937782b6

SHA256
62838cd8d1174ff0e3d73b2a4e1d2ea6d3148f3ecab9b7a518e0bc4cfacc1160

SHA512
7d16831760510ea3aff2d265b5d501463d02533f52fea246d935e0929617532ea4d8199f36cc88c99222712e4af1bd7f23622a09103bc9897fa3628bc53c9c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39ac3f20e9f9eb4b82bccc4ba7958ddf

SHA1
52a5854b7f291ace16bd604ab4b0701dc0c44741

SHA256
21704fc251c130d5e6fb22db972c6f863238a5820a56cad18c0ee8b05268f207

SHA512
00592cab9bcc6728d133ad612839ffdf7fa7cbbb300dff09323412b9d3dbc4dba3cfcac3a98578be2267c767f06234c21977dae854f8c547881708ee5d5ec8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d5e3724b1574f923aebf557ea23c86e

SHA1
f0bdc8861abcbb66d19a6aa59efdbfd3ed6bb821

SHA256
34fb6342618dcb4b15e42e472ee8ba693f2bf30d9d48ba35fbe2e1ab992b682c

SHA512
2a38b8a25ea3ec21dbd186a68978c676a889a012666f3fba38ff90b5fc5b1efcdd1eac26f13c53617ff3c8f2f174d01992f94c17988a4f8b03f5fa831cfaae6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4889732fd29032c0b77bc41b2fc4f159

SHA1
c409b5a7b7a28b9ef788f31c10525cb3f1bce943

SHA256
c1dab6f1270bee7c899f6fb85fff11aa9da25ff6a5d165b034f35a97638bc4de

SHA512
427e476ca783bf42326fdf60920feddab71e0ce19e84b2d99ccc294671d9f9fec188b8f7d81de0e153ab0e6d2b02790f461206a3e60d113d34f5f5ffcd990157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
734d72a4616f1cc39b07a4d8637a8dd1

SHA1
d5cbdb3ccc41f824136c24e6cea2e1dc53cf7a55

SHA256
a567013cfc0ccd3c68de13e65c0e08594ff91431cae5a0e057e5d46cf9143b76

SHA512
fc744889659e593ab0e43f372a187fa386a0a3b0d6bf21adc6e59e714f369fd085eb47359864dbd17262e36603cf4b2c4c47af6f4881a950f1d54b9b8810a765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2841f0555af94e5ebcac2e876c23ad13

SHA1
23fc6790895dc64a1afc6e24f5dbef51b82585e4

SHA256
11df75f96a2b9f6929946e17f2fec5004934b819a58ff9bc63d6381b48c7ac36

SHA512
b2e099728ba7269666d1328bb09edbcfe04bbf17aa6936fb2f9430b79b79df1f803d5b7e9aa9af58702e727ca43bfc259f80d70d58a489b5421ec2d7dc8b8cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ee95edc9ba4144ae0c936d0ec6a3a09

SHA1
95f051b7d55f3ecc48e5117b4775e143c85f82db

SHA256
049f167a81591e0b9821b478a030d6cc6f14d3bd52dc68a0b17f64e364ae3160

SHA512
f0d3ef6d546a1a6897700cc792da76e9bd7cd11dbc34e80a5cffb768033067f6bc8404641057298042ea9170a38520330e2a6df2a5f73f38b34ab53404164efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37E4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38D6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit